The security log lists all actions performed within the last 90 days.
In the upper-right corner of any page, click your profile photo, then click Settings.
In the "Archives" section of the sidebar, click Security log.
The name for each audit log entry is composed of a category of events, followed by an operation type. For example, the
repo.create entry refers to the
create operation on the
Each audit log entry shows applicable information about an event, such as:
- The enterprise or organization an action was performed in
- The user (actor) who performed the action
- The user affected by the action
- Which repository an action was performed in
- The action that was performed
- Which country the action took place in
- The date and time the action occurred
- The SAML SSO identity of the user (actor) who performed the action (public beta)
- For actions outside of the web UI, how the user (actor) authenticated
- Optionally, the source IP address for the user (actor) who performed the action
Note that you cannot search for entries using text. You can, however, construct search queries using a variety of filters. Many operators used when querying the log, such as
<, match the same format as searching across GitHub Enterprise Cloud. For more information, see "About searching on GitHub."
operation qualifier to limit actions to specific types of operations. For example:
operation:accessfinds all events where a resource was accessed.
operation:authenticationfinds all events where an authentication event was performed.
operation:createfinds all events where a resource was created.
operation:modifyfinds all events where an existing resource was modified.
operation:removefinds all events where an existing resource was removed.
operation:restorefinds all events where an existing resource was restored.
operation:transferfinds all events where an existing resource was transferred.
repo qualifier to limit actions to a specific repository. For example:
repo:my-org/our-repofinds all events that occurred for the
our-reporepository in the
repo:my-org/our-repo repo:my-org/another-repofinds all events that occurred for both the
another-reporepositories in the
-repo:my-org/not-this-repoexcludes all events that occurred for the
not-this-reporepository in the
Note that you must include the account name within the
repo qualifier; searching for just
repo:our-repo will not work.
actor qualifier can scope events based on who performed the action. For example:
actor:octocatfinds all events performed by
actor:octocat actor:hubotfinds all events performed by
-actor:hubotexcludes all events performed by
Note that you can only use a GitHub Enterprise Cloud username, not an individual's real name.
The events listed in your security log are triggered by your actions. Actions are grouped into different categories. For the full list of events in each category, see "Security log events."
|Contains all activities related to your billing information.|
|Contains all activities related to GitHub Codespaces. For more information, see "GitHub Codespaces overview."|
|Contains all activities related to Copilot Business. For more information, see "Overview of GitHub Copilot."|
|Contains all activities related to signing the GitHub Marketplace Developer Agreement.|
|Contains all activities related to listing apps in GitHub Marketplace.|
|Contains all activities related to OAuth access tokens.|
|Contains all activities related to authorizing OAuth apps. For more information, see "Authorizing OAuth apps."|
|Contains activities related to your passkeys. For more information, see "About passkeys."|
|Contains all activities related to paying for your GitHub subscription.|
|Contains activities related to fine-grained personal access tokens. For more information, see "Managing your personal access tokens."|
|Contains all activities related to your profile picture.|
|Contains all activities related to project boards.|
|Contains all activities related to your public SSH keys.|
|Contains all activities related to the repositories you own.|
|Contains all events related to GitHub Sponsors and sponsor buttons (see "About GitHub Sponsors" and "Displaying a sponsor button in your repository")|
|Contains all activities related to two-factor authentication.|
|Contains all activities related to your account.|
You can export the log as JSON data or a comma-separated value (CSV) file with the Export dropdown menu.
To filter the results in your export, search by one or more of these supported qualifiers before using the Export dropdown menu.
|After you export the log, you'll see the following keys and values in the resulting file.|
|1429548104000 (Timestamp shows the time since Epoch with milliseconds.)|
|["issues", "issue_comment", "pull_request", "pull_request_review_comment"]|
|["push", "pull_request", "issues"]|