From 256ae222b64d814bd688a81cc8d9a1868dee34bf Mon Sep 17 00:00:00 2001 From: docs-bot <77750099+docs-bot@users.noreply.github.com> Date: Sat, 31 Jan 2026 19:39:31 -0800 Subject: [PATCH] Update audit log event data (#59402) Co-authored-by: Sunbrye Ly <56200261+sunbrye@users.noreply.github.com> --- src/audit-logs/data/fpt/organization.json | 101 ++++++++++++++ src/audit-logs/data/ghec/enterprise.json | 124 ++++++++++++++++++ src/audit-logs/data/ghec/organization.json | 101 ++++++++++++++ .../data/ghes-3.14/organization.json | 51 +++++++ .../data/ghes-3.15/organization.json | 51 +++++++ .../data/ghes-3.16/organization.json | 51 +++++++ .../data/ghes-3.17/organization.json | 51 +++++++ .../data/ghes-3.18/organization.json | 51 +++++++ .../data/ghes-3.19/organization.json | 51 +++++++ .../data/ghes-3.20/organization.json | 51 +++++++ src/audit-logs/lib/config.json | 2 +- 11 files changed, 684 insertions(+), 1 deletion(-) diff --git a/src/audit-logs/data/fpt/organization.json b/src/audit-logs/data/fpt/organization.json index 0494c45b2b03..70970ee0b6d0 100644 --- a/src/audit-logs/data/fpt/organization.json +++ b/src/audit-logs/data/fpt/organization.json @@ -3432,6 +3432,57 @@ "programmatic_access_type" ] }, + { + "action": "issue_comment.pinned", + "description": "A comment on an issue was pinned to a repository.", + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "request_id", + "request_access_security_header", + "hashed_token", + "programmatic_access_type", + "actor", + "actor_id", + "oauth_application_id", + "token_id", + "token_scopes", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "actor_is_bot" + ] + }, + { + "action": "issue_comment.unpinned", + "description": "A comment on an issue was unpinned from a repository.", + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "request_id", + "request_access_security_header", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "actor_is_bot" + ] + }, { "action": "issue_comment.update", "description": "A comment on an issue (other than the initial one) changed.", @@ -13544,6 +13595,56 @@ "actor_is_bot" ] }, + { + "action": "repository_dependency_updates_self_hosted.disabled", + "description": "Dependency updates on self-hosted runners was disabled.", + "docs_reference_links": "code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/managing-dependabot-on-self-hosted-runners", + "fields": [ + "actor", + "actor_id", + "user_agent", + "request_id", + "request_access_security_header", + "user", + "user_id", + "repo", + "repo_id", + "public_repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ], + "docs_reference_titles": "code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/managing-dependabot-on-self-hosted-runners" + }, + { + "action": "repository_dependency_updates_self_hosted.enabled", + "description": "Dependency updates on self-hosted runners was enabled.", + "docs_reference_links": "code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/managing-dependabot-on-self-hosted-runners", + "fields": [ + "topic", + "actor", + "actor_id", + "user", + "user_id", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "actor_is_bot", + "actor_is_agent" + ], + "docs_reference_titles": "code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/managing-dependabot-on-self-hosted-runners" + }, { "action": "repository_image.create", "description": "An image to represent a repository was uploaded.", diff --git a/src/audit-logs/data/ghec/enterprise.json b/src/audit-logs/data/ghec/enterprise.json index 4fa6173288fe..79a2360c6f27 100644 --- a/src/audit-logs/data/ghec/enterprise.json +++ b/src/audit-logs/data/ghec/enterprise.json @@ -1898,6 +1898,29 @@ "user_id" ] }, + { + "action": "business.members_limit_reached", + "description": "An enterprise has reached its members limit.", + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "request_id", + "request_access_security_header", + "name", + "limit", + "count", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "actor_is_bot" + ] + }, { "action": "business.organizations_limit_warning", "description": "An enterprise is approaching its organizations limit.", @@ -7462,6 +7485,57 @@ "programmatic_access_type" ] }, + { + "action": "issue_comment.pinned", + "description": "A comment on an issue was pinned to a repository.", + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "request_id", + "request_access_security_header", + "hashed_token", + "programmatic_access_type", + "actor", + "actor_id", + "oauth_application_id", + "token_id", + "token_scopes", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "actor_is_bot" + ] + }, + { + "action": "issue_comment.unpinned", + "description": "A comment on an issue was unpinned from a repository.", + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "request_id", + "request_access_security_header", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "actor_is_bot" + ] + }, { "action": "issue_comment.update", "description": "A comment on an issue (other than the initial one) changed.", @@ -17032,6 +17106,56 @@ "actor_is_bot" ] }, + { + "action": "repository_dependency_updates_self_hosted.disabled", + "description": "Dependency updates on self-hosted runners was disabled.", + "docs_reference_links": "code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/managing-dependabot-on-self-hosted-runners", + "fields": [ + "actor", + "actor_id", + "user_agent", + "request_id", + "request_access_security_header", + "user", + "user_id", + "repo", + "repo_id", + "public_repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ], + "docs_reference_titles": "code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/managing-dependabot-on-self-hosted-runners" + }, + { + "action": "repository_dependency_updates_self_hosted.enabled", + "description": "Dependency updates on self-hosted runners was enabled.", + "docs_reference_links": "code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/managing-dependabot-on-self-hosted-runners", + "fields": [ + "topic", + "actor", + "actor_id", + "user", + "user_id", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "actor_is_bot", + "actor_is_agent" + ], + "docs_reference_titles": "code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/managing-dependabot-on-self-hosted-runners" + }, { "action": "repository_image.create", "description": "An image to represent a repository was uploaded.", diff --git a/src/audit-logs/data/ghec/organization.json b/src/audit-logs/data/ghec/organization.json index 0494c45b2b03..70970ee0b6d0 100644 --- a/src/audit-logs/data/ghec/organization.json +++ b/src/audit-logs/data/ghec/organization.json @@ -3432,6 +3432,57 @@ "programmatic_access_type" ] }, + { + "action": "issue_comment.pinned", + "description": "A comment on an issue was pinned to a repository.", + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "request_id", + "request_access_security_header", + "hashed_token", + "programmatic_access_type", + "actor", + "actor_id", + "oauth_application_id", + "token_id", + "token_scopes", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "actor_is_bot" + ] + }, + { + "action": "issue_comment.unpinned", + "description": "A comment on an issue was unpinned from a repository.", + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "request_id", + "request_access_security_header", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "actor_is_bot" + ] + }, { "action": "issue_comment.update", "description": "A comment on an issue (other than the initial one) changed.", @@ -13544,6 +13595,56 @@ "actor_is_bot" ] }, + { + "action": "repository_dependency_updates_self_hosted.disabled", + "description": "Dependency updates on self-hosted runners was disabled.", + "docs_reference_links": "code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/managing-dependabot-on-self-hosted-runners", + "fields": [ + "actor", + "actor_id", + "user_agent", + "request_id", + "request_access_security_header", + "user", + "user_id", + "repo", + "repo_id", + "public_repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ], + "docs_reference_titles": "code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/managing-dependabot-on-self-hosted-runners" + }, + { + "action": "repository_dependency_updates_self_hosted.enabled", + "description": "Dependency updates on self-hosted runners was enabled.", + "docs_reference_links": "code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/managing-dependabot-on-self-hosted-runners", + "fields": [ + "topic", + "actor", + "actor_id", + "user", + "user_id", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "actor_is_bot", + "actor_is_agent" + ], + "docs_reference_titles": "code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/managing-dependabot-on-self-hosted-runners" + }, { "action": "repository_image.create", "description": "An image to represent a repository was uploaded.", diff --git a/src/audit-logs/data/ghes-3.14/organization.json b/src/audit-logs/data/ghes-3.14/organization.json index 6d0ec7889b6f..33ee317030bb 100644 --- a/src/audit-logs/data/ghes-3.14/organization.json +++ b/src/audit-logs/data/ghes-3.14/organization.json @@ -2963,6 +2963,57 @@ "programmatic_access_type" ] }, + { + "action": "issue_comment.pinned", + "description": "A comment on an issue was pinned to a repository.", + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "request_id", + "request_access_security_header", + "hashed_token", + "programmatic_access_type", + "actor", + "actor_id", + "oauth_application_id", + "token_id", + "token_scopes", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "actor_is_bot" + ] + }, + { + "action": "issue_comment.unpinned", + "description": "A comment on an issue was unpinned from a repository.", + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "request_id", + "request_access_security_header", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "actor_is_bot" + ] + }, { "action": "issue_comment.update", "description": "A comment on an issue (other than the initial one) changed.", diff --git a/src/audit-logs/data/ghes-3.15/organization.json b/src/audit-logs/data/ghes-3.15/organization.json index ca035aaf6173..6c8b68aaf806 100644 --- a/src/audit-logs/data/ghes-3.15/organization.json +++ b/src/audit-logs/data/ghes-3.15/organization.json @@ -2987,6 +2987,57 @@ "programmatic_access_type" ] }, + { + "action": "issue_comment.pinned", + "description": "A comment on an issue was pinned to a repository.", + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "request_id", + "request_access_security_header", + "hashed_token", + "programmatic_access_type", + "actor", + "actor_id", + "oauth_application_id", + "token_id", + "token_scopes", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "actor_is_bot" + ] + }, + { + "action": "issue_comment.unpinned", + "description": "A comment on an issue was unpinned from a repository.", + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "request_id", + "request_access_security_header", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "actor_is_bot" + ] + }, { "action": "issue_comment.update", "description": "A comment on an issue (other than the initial one) changed.", diff --git a/src/audit-logs/data/ghes-3.16/organization.json b/src/audit-logs/data/ghes-3.16/organization.json index 92900d9a6e73..efae4d3be3c2 100644 --- a/src/audit-logs/data/ghes-3.16/organization.json +++ b/src/audit-logs/data/ghes-3.16/organization.json @@ -3094,6 +3094,57 @@ "programmatic_access_type" ] }, + { + "action": "issue_comment.pinned", + "description": "A comment on an issue was pinned to a repository.", + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "request_id", + "request_access_security_header", + "hashed_token", + "programmatic_access_type", + "actor", + "actor_id", + "oauth_application_id", + "token_id", + "token_scopes", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "actor_is_bot" + ] + }, + { + "action": "issue_comment.unpinned", + "description": "A comment on an issue was unpinned from a repository.", + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "request_id", + "request_access_security_header", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "actor_is_bot" + ] + }, { "action": "issue_comment.update", "description": "A comment on an issue (other than the initial one) changed.", diff --git a/src/audit-logs/data/ghes-3.17/organization.json b/src/audit-logs/data/ghes-3.17/organization.json index d410046886e7..57fcd02eb76e 100644 --- a/src/audit-logs/data/ghes-3.17/organization.json +++ b/src/audit-logs/data/ghes-3.17/organization.json @@ -3260,6 +3260,57 @@ "programmatic_access_type" ] }, + { + "action": "issue_comment.pinned", + "description": "A comment on an issue was pinned to a repository.", + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "request_id", + "request_access_security_header", + "hashed_token", + "programmatic_access_type", + "actor", + "actor_id", + "oauth_application_id", + "token_id", + "token_scopes", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "actor_is_bot" + ] + }, + { + "action": "issue_comment.unpinned", + "description": "A comment on an issue was unpinned from a repository.", + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "request_id", + "request_access_security_header", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "actor_is_bot" + ] + }, { "action": "issue_comment.update", "description": "A comment on an issue (other than the initial one) changed.", diff --git a/src/audit-logs/data/ghes-3.18/organization.json b/src/audit-logs/data/ghes-3.18/organization.json index 274e27de3a20..3de92e4d061c 100644 --- a/src/audit-logs/data/ghes-3.18/organization.json +++ b/src/audit-logs/data/ghes-3.18/organization.json @@ -3309,6 +3309,57 @@ "programmatic_access_type" ] }, + { + "action": "issue_comment.pinned", + "description": "A comment on an issue was pinned to a repository.", + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "request_id", + "request_access_security_header", + "hashed_token", + "programmatic_access_type", + "actor", + "actor_id", + "oauth_application_id", + "token_id", + "token_scopes", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "actor_is_bot" + ] + }, + { + "action": "issue_comment.unpinned", + "description": "A comment on an issue was unpinned from a repository.", + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "request_id", + "request_access_security_header", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "actor_is_bot" + ] + }, { "action": "issue_comment.update", "description": "A comment on an issue (other than the initial one) changed.", diff --git a/src/audit-logs/data/ghes-3.19/organization.json b/src/audit-logs/data/ghes-3.19/organization.json index 29f171d028e2..e0d869d05dba 100644 --- a/src/audit-logs/data/ghes-3.19/organization.json +++ b/src/audit-logs/data/ghes-3.19/organization.json @@ -3451,6 +3451,57 @@ "programmatic_access_type" ] }, + { + "action": "issue_comment.pinned", + "description": "A comment on an issue was pinned to a repository.", + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "request_id", + "request_access_security_header", + "hashed_token", + "programmatic_access_type", + "actor", + "actor_id", + "oauth_application_id", + "token_id", + "token_scopes", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "actor_is_bot" + ] + }, + { + "action": "issue_comment.unpinned", + "description": "A comment on an issue was unpinned from a repository.", + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "request_id", + "request_access_security_header", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "actor_is_bot" + ] + }, { "action": "issue_comment.update", "description": "A comment on an issue (other than the initial one) changed.", diff --git a/src/audit-logs/data/ghes-3.20/organization.json b/src/audit-logs/data/ghes-3.20/organization.json index 931ccbb4e1c5..4131528a7e6e 100644 --- a/src/audit-logs/data/ghes-3.20/organization.json +++ b/src/audit-logs/data/ghes-3.20/organization.json @@ -3406,6 +3406,57 @@ "programmatic_access_type" ] }, + { + "action": "issue_comment.pinned", + "description": "A comment on an issue was pinned to a repository.", + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "request_id", + "request_access_security_header", + "hashed_token", + "programmatic_access_type", + "actor", + "actor_id", + "oauth_application_id", + "token_id", + "token_scopes", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "actor_is_bot" + ] + }, + { + "action": "issue_comment.unpinned", + "description": "A comment on an issue was unpinned from a repository.", + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "request_id", + "request_access_security_header", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "actor_is_bot" + ] + }, { "action": "issue_comment.update", "description": "A comment on an issue (other than the initial one) changed.", diff --git a/src/audit-logs/lib/config.json b/src/audit-logs/lib/config.json index eb5373a92cbe..c7ed4ba847a3 100644 --- a/src/audit-logs/lib/config.json +++ b/src/audit-logs/lib/config.json @@ -9,5 +9,5 @@ "git": "Note: Git events have special access requirements and retention policies that differ from other audit log events. For GitHub Enterprise Cloud, access Git events via the REST API only with 7-day retention. For GitHub Enterprise Server, Git events must be enabled in audit log configuration and are not included in search results.", "sso_redirect": "Note: Automatically redirecting users to sign in is currently in beta for Enterprise Managed Users and subject to change." }, - "sha": "146f9ede19fd24291cab5d48f7a00cc22d3cfdba" + "sha": "73684e3d2a66602f604f4b714d2c26887592efd1" } \ No newline at end of file