Skip to main content

Searching the audit log for your enterprise

You can search an extensive list of audited actions in your enterprise.

Who can use this feature?

Enterprise owners can search the audit log.

About search for the enterprise audit log

You can search your enterprise audit log directly from the user interface by using the Filters dropdown, or by typing a search query.

For more information about viewing your enterprise audit log, see "Accessing the audit log for your enterprise."

Note: Git events are not included in search results.

You can also use the API to retrieve audit log events. For more information, see "Using the audit log API for your enterprise."

You cannot search for entries using text. You can, however, construct search queries using a variety of filters. Many operators used when querying the log, such as -, >, or <, match the same format as searching across GitHub Enterprise Cloud. For more information, see "About searching on GitHub."

Note: The audit log lists events triggered by activities that affect your enterprise within the last 180 days. The audit log retains Git events for seven days.

By default, only events from the past three months are displayed. To view older events, you must specify a date range with the created parameter. See "Understanding the search syntax."

Search query filters

FilterDescription
Yesterday's activityAll actions created in the past day.
Enterprise account managementAll actions in the business category.
Organization membershipAll actions for when a new user was invited to join an organization.
Team managementAll actions related to team management.
- When a user account or repository was added or removed from a team
- When a team maintainer was promoted or demoted
- When a team was deleted
Repository managementAll actions for repository management.
- When a repository was created or deleted
- When the repository visibility was changed
- When a team was added or removed from a repository
Billing updatesAll actions concerning how your enterprise pays for GitHub and for when your billing email address was changed.
Hook activityAll actions for webhooks and pre-receive hooks.
Security managementAll actions concerning SSH keys, deploy keys, security keys, 2FA, and SAML single sign-on credential authorization, and vulnerability alerts for repositories.

Search query syntax

You can compose a search query from one or more key:value pairs. For example, to see all actions that have affected the repository octocat/Spoon-Knife since the beginning of 2017:

repo:"octocat/Spoon-Knife" created:>=2017-01-01

The key:value pairs that can be used in a search query are:

KeyValue
actionName of the audited action.
actorName of the user account that initiated the action.
createdTime at which the action occurred.
countryName of the country where the actor was when performing the action.
country_codeTwo-letter short code of the country where the actor was when performing the action.
hashed_tokenThe token used to authenticate for the action (if applicable, see "Identifying audit log events performed by an access token").
ipIP address of the actor.
operationOperation type that corresponds with the action. Operation types are create, access, modify, remove, authentication, transfer, and restore.
repositoryName with owner of the repository where the action occurred (such as octocat/octo-repo).
userName of the user affected by the action.

To see actions grouped by category, you can also use the action qualifier as a key:value pair. For more information, see "Search based on the action performed."

For a full list of actions in your enterprise audit log, see "Audit log events for your enterprise."

Searching the audit log

Search based on operation

Use the operation qualifier to limit actions to specific types of operations. For example:

  • operation:access finds all events where a resource was accessed.
  • operation:authentication finds all events where an authentication event was performed.
  • operation:create finds all events where a resource was created.
  • operation:modify finds all events where an existing resource was modified.
  • operation:remove finds all events where an existing resource was removed.
  • operation:restore finds all events where an existing resource was restored.
  • operation:transfer finds all events where an existing resource was transferred.

Search based on repository

Use the repo qualifier to limit actions to a specific repository. For example:

  • repo:my-org/our-repo finds all events that occurred for the our-repo repository in the my-org organization.
  • repo:my-org/our-repo repo:my-org/another-repo finds all events that occurred for both the our-repo and another-repo repositories in the my-org organization.
  • -repo:my-org/not-this-repo excludes all events that occurred for the not-this-repo repository in the my-org organization.

Note that you must include the account name within the repo qualifier; searching for just repo:our-repo will not work.

Search based on the user

The actor qualifier can scope events based on who performed the action. For example:

  • actor:octocat finds all events performed by octocat.
  • actor:octocat actor:hubot finds all events performed by octocat or hubot.
  • -actor:hubot excludes all events performed by hubot.

Note that you can only use a GitHub Enterprise Cloud username, not an individual's real name.

Search based on the action performed

To search for specific events, use the action qualifier in your query. For example:

  • action:team finds all events grouped within the team category.
  • -action:hook excludes all events in the webhook category.

Each category has a set of associated actions that you can filter on. For example:

  • action:team.create finds all events where a team was created.
  • -action:hook.events_changed excludes all events where the events on a webhook have been altered.

Actions that can be found in your enterprise audit log are grouped within the following categories:

Category nameDescription
accountContains activities related to an organization account.
advisory_creditContains activities related to crediting a contributor for a security advisory in the GitHub Advisory Database. For more information, see "About repository security advisories."
artifactContains activities related to GitHub Actions workflow run artifacts.
audit_log_streamingContains activities related to streaming audit logs for organizations in an enterprise account.
billingContains activities related to an organization's billing.
businessContains activities related to business settings for an enterprise.
business_advanced_securityContains activities related to GitHub Advanced Security in an enterprise. For more information, see "Managing GitHub Advanced Security features for your enterprise."
business_secret_scanningContains activities related to secret scanning in an enterprise. For more information, see "Managing GitHub Advanced Security features for your enterprise."
business_secret_scanning_automatic_validity_checksContains activities related to enabling or disabling automatic validity checks for secret scanning in an enterprise. For more information, see "Managing GitHub Advanced Security features for your enterprise."
business_secret_scanning_custom_patternContains activities related to custom patterns for secret scanning in an enterprise.
business_secret_scanning_custom_pattern_push_protectionContains activities related to push protection of a custom pattern for secret scanning in an enterprise. For more information, see "Defining custom patterns for secret scanning."
business_secret_scanning_push_protectionContains activities related to the push protection feature of secret scanning in an enterprise. For more information, see "Managing GitHub Advanced Security features for your enterprise."
business_secret_scanning_push_protection_custom_messageContains activities related to the custom message displayed when push protection is triggered in an enterprise. For more information, see "Managing GitHub Advanced Security features for your enterprise."
checksContains activities related to check suites and runs.
codespacesContains activities related to an organization's codespaces.
commit_commentContains activities related to updating or deleting commit comments.
dependabot_alertsContains organization-level configuration activities for Dependabot alerts in existing repositories. For more information, see "About Dependabot alerts."
dependabot_alerts_new_reposContains organization-level configuration activities for Dependabot alerts in new repositories created in the organization.
dependabot_repository_accessContains activities related to which private repositories in an organization Dependabot is allowed to access.
dependabot_security_updatesContains organization-level configuration activities for Dependabot security updates in existing repositories. For more information, see "Configuring Dependabot security updates."
dependabot_security_updates_new_reposContains organization-level configuration activities for Dependabot security updates for new repositories created in the organization.
dependency_graphContains organization-level configuration activities for dependency graphs for repositories. For more information, see "About the dependency graph."
dependency_graph_new_reposContains organization-level configuration activities for new repositories created in the organization.
dotcom_connectionContains activities related to GitHub Connect.
enterpriseContains activities related to enterprise settings.
enterprise_domainContains activities related to verified enterprise domains.
enterprise_installationContains activities related to GitHub Apps associated with an GitHub Connect enterprise connection.
environmentContains activities related to GitHub Actions environments.
hookContains activities related to webhooks.
integrationContains activities related to integrations in an account.
integration_installationContains activities related to integrations installed in an account.
integration_installation_requestContains activities related to organization member requests for owners to approve integrations for use in the organization.
ip_allow_listContains activities related to enabling or disabling the IP allow list for an organization.
ip_allow_list_entryContains activities related to the creation, deletion, and editing of an IP allow list entry for an organization.
issueContains activities related to pinning, transferring, or deleting an issue in a repository.
issue_commentContains activities related to pinning, transferring, or deleting issue comments.
issuesContains activities related to enabling or disabling issue creation for an organization.
marketplace_agreement_signatureContains activities related to signing the GitHub Marketplace Developer Agreement.
marketplace_listingContains activities related to listing apps in GitHub Marketplace.
members_can_create_pagesContains activities related to managing the publication of GitHub Pages sites for repositories in the organization. For more information, see "Managing the publication of GitHub Pages sites for your organization."
members_can_create_private_pagesContains activities related to managing the publication of private GitHub Pages sites for repositories in the organization.
members_can_create_public_pagesContains activities related to managing the publication of public GitHub Pages sites for repositories in the organization.
members_can_delete_reposContains activities related to enabling or disabling repository creation for an organization.
members_can_view_dependency_insightsContains organization-level configuration activities allowing organization members to view dependency insights.
migrationContains activities related to transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.
oauth_accessContains activities related to OAuth access tokens.
oauth_applicationContains activities related to OAuth apps.
oauth_authorizationContains activities related to authorizing OAuth apps.
orgContains activities related to organization membership.
org_credential_authorizationContains activities related to authorizing credentials for use with SAML single sign-on.
org_secret_scanning_automatic_validity_checksContains activities related to enabling or disabling automatic validity checks for secret scanning in an organization. For more information, see "Managing security and analysis settings for your organization."
org_secret_scanning_custom_patternContains activities related to custom patterns for secret scanning in an organization. For more information, see "Defining custom patterns for secret scanning."
organization_default_labelContains activities related to default labels for repositories in an organization.
organization_domainContains activities related to verified organization domains.
organization_projects_changeContains activities related to organization-wide projects (classic) in an enterprise.
pages_protected_domainContains activities related to verified custom domains for GitHub Pages.
payment_methodContains activities related to how an organization pays for GitHub.
prebuild_configurationContains activities related to prebuild configurations for GitHub Codespaces.
private_repository_forkingContains activities related to allowing forks of private and internal repositories, for a repository, organization or enterprise.
profile_pictureContains activities related to an organization's profile picture.
projectContains activities related to projects.
project_fieldContains activities related to field creation and deletion in a project.
project_viewContains activities related to view creation and deletion in a project.
protected_branchContains activities related to protected branches.
public_keyContains activities related to SSH keys and deploy keys.
pull_requestContains activities related to pull requests.
pull_request_reviewContains activities related to pull request reviews.
pull_request_review_commentContains activities related to pull request review comments.
repoContains activities related to the repositories owned by an organization.
repository_advisoryContains repository-level activities related to security advisories in the GitHub Advisory Database. For more information, see "About repository security advisories."
repository_content_analysisContains activities related to enabling or disabling data use for a private repository. For more information, see "Managing security and analysis settings for your repository."
repository_dependency_graphContains repository-level activities related to enabling or disabling the dependency graph for a private repository. For more information, see "About the dependency graph."
repository_imageContains activities related to images for a repository.
repository_invitationContains activities related to invitations to join a repository.
repository_projects_changeContains activities related to enabling projects for a repository or for all repositories in an organization.
repository_secret_scanningContains repository-level activities related to secret scanning. For more information, see "About secret scanning."
repository_secret_scanning_automatic_validity_checksContains activities related to enabling or disabling automatic validity checks for secret scanning in a repository. For more information, see "Enabling secret scanning for your repository."
repository_secret_scanning_custom_patternContains activities related to secret scanning custom patterns in a repository. For more information, see "Defining custom patterns for secret scanning."
repository_secret_scanning_custom_pattern_push_protectionContains activities related to push protection of a custom pattern for secret scanning in a repository. For more information, see "Defining custom patterns for secret scanning."
repository_secret_scanning_push_protectionContains activities related to the push protection feature of secret scanning in a repository. For more information, see "About push protection."
repository_visibility_changeContains activities related to allowing organization members to change repository visibilities for the organization.
repository_vulnerability_alertContains activities related to Dependabot alerts.
repository_vulnerability_alertsContains repository-level configuration activities for Dependabot alerts.
required_status_checkContains activities related to required status checks for protected branches.
restrict_notification_deliveryContains activities related to the restriction of email notifications to approved or verified domains for an enterprise.
roleContains activities related to custom repository roles.
secret_scanningContains organization-level configuration activities for secret scanning in existing repositories. For more information, see "About secret scanning."
secret_scanning_new_reposContains organization-level configuration activities for secret scanning for new repositories created in the organization.
security_keyContains activities related to security keys registration and removal.
sponsorsContains events related to sponsor buttons (see "Displaying a sponsor button in your repository").
ssh_certificate_authorityContains activities related to a SSH certificate authority in an organization or enterprise.
ssh_certificate_requirementContains activities related to requiring members use SSH certificates to access organization resources.
sso_redirectContains activities related to automatically redirecting users to sign in (see "Enforcing policies for security settings in your enterprise").
staffContains activities related to a site admin performing an action.
teamContains activities related to teams in an organization.
team_sync_tenantContains activities related to team synchronization with an IdP for an enterprise or organization.
userContains activities related to users in an enterprise or organization.
user_licenseContains activities related to a user occupying a licensed seat in, and being a member of, an enterprise.
workflowsContains activities related to GitHub Actions workflows.

Search based on time of action

Use the created qualifier to filter events in the audit log based on when they occurred.

Date formatting must follow the ISO8601 standard, which is YYYY-MM-DD (year-month-day). You can also add optional time information THH:MM:SS+00:00 after the date, to search by the hour, minute, and second. That's T, followed by HH:MM:SS (hour-minutes-seconds), and a UTC offset (+00:00).

When you search for a date, you can use greater than, less than, and range qualifiers to further filter results. For more information, see "Understanding the search syntax."

For example:

  • created:2014-07-08 finds all events that occurred on July 8th, 2014.
  • created:>=2014-07-08 finds all events that occurred on or after July 8th, 2014.
  • created:<=2014-07-08 finds all events that occurred on or before July 8th, 2014.
  • created:2014-07-01..2014-07-31 finds all events that occurred in the month of July 2014.

Search based on location

Using the qualifier country, you can filter events in the audit log based on the originating country. You can use a country's two-letter short code or full name. Countries with spaces in their name will need to be wrapped in quotation marks. For example:

  • country:de finds all events that occurred in Germany.
  • country:Mexico finds all events that occurred in Mexico.
  • country:"United States" all finds events that occurred in the United States.

Search based on the token that performed the action

Use the hashed_token qualifier to search based on the token that performed the action. Before you can search for a token, you must generate a SHA-256 hash. For more information, see "Identifying audit log events performed by an access token."