Note
This article contains the events that may appear in your user account's security log. For the events that can appear in an organization's audit log or the audit log for an enterprise, see Audit log events for your organization and Audit log events for your enterprise.
About security log events
The name for each audit log entry is composed of a category of events, followed by an operation type. For example, the repo.create entry refers to the create operation on the repo category. The reference information in this article is grouped by categories.
Audit log events
account
account.plan_change- The account's plan changed.
- Fields
@timestamp,_document_id,action,actor,actor_id,business,business_id,hashed_token,org,org_id,programmatic_access_type,repo,repo_id,repository,repository_id,request_access_security_header,request_id,token_id,token_scopes,user,user_id,user_agent,actor_is_agent,actor_is_bot,created_at,oauth_application_id,operation_type- Reference
- How GitHub billing works
actions_cache
actions_cache.delete- A GitHub Actions cache was deleted using the REST API.
- Fields
@timestamp,_document_id,action,actor,actor_id,business,business_id,hashed_token,org,org_id,programmatic_access_type,repo,repo_id,repository,repository_id,request_access_security_header,request_id,token_id,token_scopes,user,user_id,user_agent,actions_cache_id,actions_cache_key,actions_cache_scope,actions_cache_version,actor_is_agent,actor_is_bot,created_at,oauth_application_id,operation_type,user_programmatic_access_name
artifact
artifact.destroy- A workflow run artifact was manually deleted.
- Fields
@timestamp,_document_id,action,actor,actor_id,business,business_id,hashed_token,org,org_id,programmatic_access_type,repo,repo_id,repository,repository_id,request_access_security_header,request_id,token_id,token_scopes,user,user_id,user_agent,actor_is_bot,created_at,oauth_application_id,operation_type,public_repo,user_programmatic_access_name,workflow_run_id
billing
billing.budget_create- A billing budget was created for a business or organization. Includes details about the budget limit, alerting preferences, and recipients.
- Fields
@timestamp,_document_id,action,actor,actor_id,business,business_id,hashed_token,org,org_id,programmatic_access_type,repo,repo_id,repository,repository_id,request_access_security_header,request_id,token_id,token_scopes,user,user_id,user_agent,actor_is_agent,actor_is_bot,alert_enabled,alert_recipient_user_ids,budget_limit_type,created_at,customer_id,exclude_cost_center_usage,oauth_application_id,operation_type,pricing_target_id,pricing_target_type,status,target_amount,target_id,target_type,user_programmatic_access_name
billing.budget_delete- A billing budget was deleted for a business or organization. Includes details about the removed budget and any alerting settings.
- Fields
@timestamp,_document_id,action,actor,actor_id,business,business_id,hashed_token,org,org_id,programmatic_access_type,repo,repo_id,repository,repository_id,request_access_security_header,request_id,token_id,token_scopes,user,user_id,user_agent,actor_is_bot,alert_enabled,budget_limit_type,created_at,customer_id,exclude_cost_center_usage,oauth_application_id,operation_type,pricing_target_id,pricing_target_type,status,target_amount,target_type,user_programmatic_access_name,uuid
billing.budget_update- A billing budget was updated for a business or organization. Includes details about the updated limit and alerting settings.
- Fields